How We Price — StaticCodeAudit | Annual License, No Seat Fee

The three levers we measure

Pricing scales on the size of the codebase you scan and the depth of customization you need — not on the number of engineers in your team.

📄

Files per scan

Maximum number of source files in a single audit run. Caps the typical scan envelope.

Range: 1 → 10 000 → unlimited

recommended cap

📐

Lines of code (SLOC)

Source Lines Of Code excluding blanks and comments — same definition as SonarQube and Cloc. Combined with files in a strict AND: whichever cap is reached first stops the scan with a warning.

Range: 10 → 1 M → unlimited

coming soon

🛠️

Custom rules

Quota reserved for custom .sca rules, on top of the 708 built-in rules. Self-service authoring is not live yet — reach out if you need custom rules now.

Range: 1 → 500 → unlimited

What each tier includes

Three dimensions define your tier: the number of files, the volume of source code, and the number of custom rules you need. Prices are shared on request.

Free

Demo

Files per scan3
Max SLOC100
Custom rules1coming soon
Export formatsAll + priority support

No credit card required.

Open the sample report

Solo

Files per scan100
Max SLOC1K
Custom rules10coming soon
Export formatsHTML

Get a quote

How we compare to the main competitors

Pricing snapshot collected from public product pages, 2026. Each competitor has its own strengths — the right tool depends on your privacy posture, deployment constraints and budget shape.

Tool	Deployment model	Typical pricing	Offline	Best fit for
StaticCodeAudit CodeFixture	Self-contained binary, runs locally	Quote on request	✓	Privacy-first orgs (health, defense, finance, public, legal). PME / ETI / consulting.
Snyk Code snyk.io	SaaS — code uploaded	$25–40 / dev / month	✗	Cloud-native teams accepting SaaS. IDE-first workflow.
SonarCloud sonarsource.com	SaaS — code uploaded	$10–25 / dev / month	✗	Teams already in the Sonar ecosystem who don't mind cloud.
SonarQube Developer / Enterprise	Self-hosted server (Java + DB)	$2 500 — $20 000+ / year	~	Large engineering orgs with infra ops capacity. White-label = Enterprise tier.
GitHub Code Security CodeQL — split from Secret Protection ($19/mo) since 2025	GitHub-integrated SaaS	$30 / committer / month	✗	Orgs fully on GitHub Enterprise.
Semgrep Pro semgrep.dev	CE OSS / Pro SaaS	$25–60 / dev / month	✗	Teams happy with YAML rules and SaaS Pro features.
Checkmarx One checkmarx.com	Enterprise SAST (on-prem optional)	$35 000 — $90 000 / year	~	Fortune 500 with established AppSec programs.
Veracode veracode.com	Enterprise SAST SaaS	$50 000+ / year	✗	Compliance-driven enterprises with central security team.

Why offline matters here

Among the major SAST tools listed above, only SCA and SonarQube self-hosted run inside your network. SonarQube requires Java + a database server. SCA is a single binary with zero outbound calls — your code can never leak through the analyzer itself.

Pricing structure differs

Most competitors price per developer or per committer, which scales linearly with team size. SCA prices on capacity (files audited, custom rules) — your cost does not grow with headcount. Annual license, no per-seat fee.

Prices shown reflect publicly listed entry-level offerings as of 2026. All competitors mentioned are valid choices in their respective contexts. Consult their official product pages for up-to-date quotes.

Understand why: SAST pricing models explained →

Why isn't the full grid public?

The detailed price grid is a competitive document — you will see it when you ask. We do not hide behind "contact sales for a 12-step demo": email the founder, get the grid in the next reply. Usually within a few hours, business days.

Want to skip the email and just get a quote on your codebase? Tell us how many source files you have and what languages you scan — three lines is enough.

Get a quote in one email

No call required, no demo gauntlet. Just tell us your stack and your team size — we send you the grid and a quote.

Ask for a quote

How we price StaticCodeAudit